CVE-2021-31597

CRITICAL

xmlhttprequest-ssl < 1.6.1 - Improper Certificate Validation

Title source: llm
STIX 2.1

Description

The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.

References (4)

Core 4
Core References
Exploit, Third Party Advisory x_refsource_misc
https://people.kingsds.network/wesgarland/xmlhttprequest-ssl-vuln.txt
Patch, Release Notes, Third Party Advisory x_refsource_misc
https://github.com/mjwwit/node-XMLHttpRequest/compare/v1.6.0...1.6.1
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20210618-0004/

Scores

CVSS v3 9.4
EPSS 0.0206
EPSS Percentile 78.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Details

CWE
CWE-295
Status published
Products (2)
npm/xmlhttprequest-ssl 0 - 1.6.1npm
xmlhttprequest-ssl_project/xmlhttprequest-ssl < 1.6.1
Published Apr 23, 2021
Tracked Since Feb 18, 2026